1. Getting root console on Pace 5268AC ATT router  (aka RG: Residential Gateway)
2. (warning: super advanced hackers only at this point)
3.  
4. Assumes you are familiar with advanced device hacking, e.g. soldering, serial uarts, linux, etc.
5. Assumes you know how to run a mips binary on an intel pc, e.g. w/ qemu-mips-static
6. Assumes you know how to binwalk/unpack att firmware, and explore their squashfs roots, etc.
7. Assumes you can use Cutter to disassemble mips binaries/libs, and generally understand what is going on
8.  
9. First of all, if you don't understand any of this - STOP - wait til others explore the cave safely and install guideropes (i.e. easier methods).
10. You can and/or will likely brick your router, etc. Pick up a used router on ebay to experiment with.
11. If you are a foolish adventurer, continue on.
12.  
13. You'll probably want to keep the router disconnected from internet/att WAN til you have what you want. When you connect it back up, it will want to auto-upgrade back to latest version which likes to disable dropbear sshd, disable serial console, remove rma user, etc. ;)
14.  
15. 1. Get access to console serial port. RX/TX are pins 13 & 15 (bottom) of the 16-pin edge connector on front of unit.
16.  
17. 2. Figure out the `rma` user root backdoor password for your router serial number. Only seems to be present and/or installed on earlier firmwares, like maybe 10.5 or 10.6?
18. Look into earlier firmwares into how the password is generated, in /sbin/sysinit: create_rma_user function. Involves /usr/bin/pseudopasswd which does some kind of shift/stream ciphering "encryption" to an input string, which part it of is the serial number. Algorithm can probably be reverse engineered (looks like xor'ing and byte swapping/rotation), however it's pretty easy to just run pseudopasswd directly in qemu-mips-static emulator on linux pc. (Involves copying qemu-mips-static binary into, and chrooting to squashfs root)
19.  
20. 3. Once you have rma user password, find and downgrade to earlier firmware, probably 10.5 (or maybe 10.6), at https://192.168.1.254/upgrade
21. Once rebooted into older firmware, you should be able to login to serial console as rma user with password determined from step 2.
22.  
23. From here you are in, and some interesting things to explore.
24.  
25. rma user gets removed/changed in later fws, and root passwd also seems to get "fixed" on some fws/boots. Create a back-door root user of some other name, and it does not seem to get removed.
26.  
27. Dropbear ssh can be enabled with `debugsys --sshdon` (but may be disabled in newer fws, see below about trusteng_cert)
28. debugsys --info dumps out some interesting info
29.  
30. Filesystem seems to be some proprietary "opentl" filesystem on top of mtd. The main/last mtd partition seems to be on /dev/opentla, and various "partitions" are like /dev/opentlaN. This might have something to do with the multiple images/settings partitions, e.g. "dual flash" etc.
31.  
32. paramtool  -show
33. seems to dump out some parameters, in what looks like one of the parameter 64k partitions in flash, /dev/opentla1 and /dev/opentla2
34. most interesting to me are device_p12 and lightspeed_p12 which are base64 encoded pkcs12 cert chains, which are encrypted with a string of device key + special string inside librgw_compat:librgw_sec_get_shroud_key() + serialnum - google for more info. lightspeed_p12 is the correct cert/key for doing eapol auth on wan port.
35.  
36. /sys/module/board/parameters/* have lots of neat info about device
37.  
38. cmc - config mgmt client (for cmd ?)
39. `cmc get cmlegacy` dumps out lots of config in a tree-like format
40.  
41. lmc - some kind of client into lmd - still not sure exactly what it does, something about various modules (might be able to somehow get eapol stuff to do more debug logging, and perhaps spill some secrets about the eapol stuff it's doing)
42.  
43. cwmc - some kind of client into cwmd, probably CWMP/TR-069 related daemon?
44.  
45. Starting around fw 11.6+ serial port is disabled on bootup by /etc/init.d/S01UART by poking on some broadcom gpios. Doesn't do this if param value of `gw:trust_engcert` is `true`
46.  
47. Not sure exactly what param `trusteng_cert` does but maybe some kind of engineering testing/qualification mode for some devices. Having this enabled seems to do a few things in a few places, like allow dropbear and serial ports to remain enabled, and also maybe how pkgc (package mgr client?) decides whether to check pkg signatures? But I'm sure that ATT can see this remotely via the phoning home that various config mgmt daemons do.
48.  
49. Newer versions of fw also seem to move dropbear sshd (if running) from 22 to some higher numbered port (like 51002).
50.  
51. USB drive automounts on /rwdata/sda1/
52.  
53. and so much more
54.  
55. update:
56. there is a faster, and easier way to grab the certs - just run this from /tmp or /rwdata/sda1 (usb):
57. https://pastebin.com/qK8A3rZt
58.  
59. --------
60.  
61. Happy hacking yall.